M&T Bank Data Breach: Sensitive Personal Information Exposed

M&T Bank, a community-focused bank serving more than 3.6 million customers across 12 states and Washington, D.C., disclosed a data breach connected to a security incident at a third-party law firm, Gelinas & Ward LLP. The incident occurred in August 2025 and involved the exposure of sensitive customer information including Social Security numbers and financial account details.

M&T Bank stated that as soon as it learned certain files containing customer personal information may have been involved, it began a comprehensive review and worked closely with the provider to assess the situation, understand its scope, and determine what data was affected.

The bank confirmed that the incident occurred entirely within the third-party law firm's environment and that M&T Bank's own systems were not affected.

The types of personal information that may have been exposed include names, Social Security numbers, credit and debit card numbers, driver's license numbers and financial account information.

The breach was first reported to the Massachusetts Office of Consumer Affairs and Business Regulation, with 462 Massachusetts residents identified as affected. The total number of individuals affected across the United States has not been disclosed.

M&T Bank sent notification letters to affected customers on April 17, 2026.

M&T Bank's response to the breach

M&T Bank is offering affected customers 24 months of complimentary credit monitoring through Equifax Complete Premier.

To enroll, customers can visit Equifax's activation page and enter the unique activation code included in their notification letter. The code is valid for 90 days from the date the letter was issued.

The monitoring service includes three-bureau credit monitoring with email notifications, daily access to Equifax credit reports, WebScan notifications when personal information is found on suspected fraudulent websites and up to $1 million in identity theft insurance coverage for certain out-of-pocket expenses. The service also includes identity restoration assistance and lost wallet support, according to enrollment materials included with the notification.

Separately, Gelinas & Ward is offering affected individuals 24 months of credit monitoring and identity theft restoration services through TransUnion.

For questions, M&T Bank has set up a dedicated phone line at 1-800-724-2440, available Monday through Friday from 6 a.m. to 9 p.m. and Saturday and Sunday from 9 a.m. to 5 p.m. Eastern Time.

Gelinas & Ward can be reached by mail at 106 Merriam Ave., Leominster, MA 01453.

Steps to take if your information was exposed

• Place a fraud alert or credit freeze by contacting Equifax (888-298-0045), Experian (1-888-397-3742) or TransUnion (1-833-799-5355) to help prevent new accounts from being opened using stolen information.
• Request and review free credit reports at AnnualCreditReport.com to check for any unfamiliar accounts or inquiries.
• Monitor bank and financial account statements closely over the next 12 to 24 months and report any suspicious transactions to the financial institution immediately.
• Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov or visit the FTC's data breach response page for step-by-step guidance.
• Watch for phishing attempts such as emails, phone calls or texts that reference M&T Bank or this breach by name, as scammers may try to use the incident to collect additional personal information.
• Consider opting out of pre-approved credit offers at OptOutPreScreen.com to reduce the chance of fraudulent credit applications.